6 ms·

This law frequently refers to "selling consumers' personal information". But hardly any company actually sells personal information. Google doesn't sell your pe

by lacker 7y ago

This law frequently refers to "selling consumers' personal information". But hardly any company actually sells personal information. Google doesn't sell your personal information, Facebook doesn't sell your personal information. Companies use your personal information to match you to advertising, not to sell the information directly. So laws forbidding the sale of personal information sort of pointless. At first I thought that this PDF was just describing the proposed law in an inaccurate manner. But no, the CCPA really does talk a lot about "selling your personal information". https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-proposed-regs.pdf https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-p...

chipotle_coyote 7y ago
This is a great point that often gets glossed over in these discussions. Facebook and Google primarily get value from your personal information by hoarding it and treating both it and the data they derive from it as proprietary.
- gorgoiler 7y ago
  The last time I used Google Takeout to download my data I got all my emails, custom maps, YouTube uploads etc., as one might expect, but what I couldn’t find were: * all the URLs I’ve visited with my Google cookie loaded * all the searches I’ve ever done * all the ads I’ve clicked on. I know ad tech mechanics can be counter intuitive but I’m surprised they don’t have that information for me to download, especially when ads and search are the primary Google functions. Maybe these logs are pseudonymized in such a way that google can’t tie them to my identity?
  - judge2020 7y ago
    They're technically not linked to your Google account I believe, https://policies.google.com/technologies/anonymization?hl=en https://policies.google.com/technologies/anonymization?hl=en (although we've seen how anonymized data can still be de-anonymized https://news.ycombinator.com/item?id=20513521 https://news.ycombinator.com/item?id=20513521 )
    - lotu 7y ago
      Correct google keeps two separate cookies one for ads and one for everything else. This was part of the agreement with the FTC when they bought Double Click. They are prohibited from joining those two cookies by that agreement.
    - gorgoiler 7y ago
      Thanks, that’s useful and interesting. Good on Google for keeping the two activities (and cookies) separate. [Edit: oof, I found my search history after all so most of this is moot. It’s under “Other Google Activity” ... “Web & App Activity”. I guess it would be nice to see the words “Search Activity” a little more prominently, but still, my bad.] I can’t help but feeling that both cookies (and their associated histories) count equally as personal data. Anyone who gets hold of my devices can use the cookies to get my history. I can use the cookies to get some of my history in some form or other (I can’t get my own search history, but I can see it partially in typeaheads on the desktop site.) It feels half hearted that I can’t pull up the entire dataset, but then I would surely be grateful that no one else can do the same thing if they steal my login. (I also accept that some of this is just me arrogantly pushing back on being told “no!” by Auntie Google, when I feel entitled to a yes.)
kitotik 7y ago
This is a critical point, but the definition of “sell” is fairly broad: “ “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.”
- saagarjha 7y ago
  So targeting ads based on personal information that you've collected is still OK, as long as you don't share the data?
  - kitotik 7y ago
    It appears so. There is a possible argument that selling an ad that will use PII to target consumers to a 3rd party advertiser constitutes a “sale” however.
  - chongli 7y ago
    The cynical side in me is now saying “of course! California’s government is not gonna shit where they eat.” We should not ever expect the government of the place where Google and Facebook are headquartered to do anything meaningful to protect privacy. To do so would destroy the business model of these companies. Why would they ever want to do that?
jiveturkey 7y ago
and what does GDPR say?
- pmiller2 7y ago
  IIRC, it refers primarily to collecting and processing consumer information.
uxamanda 7y ago
CCPA states that data is valuable and specifically calls out trading for "other valuable consideration" as part of selling. Therefore (in my read) if your business is "giving away" data, it would inherently be for "other valuable consideration". Especially since the law calls out 4 cases where sharing data is NOT a sale or valuable consideration: 1) When a consumer is sharing data with your business so that you can help them interact with a 3rd party business 2) Your business is sharing data to tell 3rd parties a consumer now wants to opt-out 3) Your business transfers data to a 3rd party to get a service from a service provider (and the data stops there, it can't be sold on) 4) Your business is acquired Edit: typo, confusing sentence
- Gaelan 7y ago
  IIRC google et al never share your data with third parties. Instead, they use it to target ads from third parties.
thanhhaimai 7y ago
This point is incorrect. There are unfortunately many companies that sell consumers' information directly [1][2]. I understand people have hatred for big companies collecting advertising related information. Nevertheless, it's misguided to pretend the industry of directly collecting and selling private information doesn't exist. Your ISPs can and do collect much worse data about us. The potential damage is much worse. I'm more worry about the lack of oversight on that industry. [1] https://arstechnica.com/tech-policy/2019/01/t-mobile-sprint-and-att-still-selling-your-location-data-report-says/ https://arstechnica.com/tech-policy/2019/01/t-mobile-sprint-... [2] https://www.forbes.com/sites/metabrown/2015/09/30/when-and-where-to-buy-consumer-data-and-12-companies-who-sell-it/ https://www.forbes.com/sites/metabrown/2015/09/30/when-and-w...

by lacker 7y ago

chipotle_coyote 7y ago

This is a great point that often gets glossed over in these discussions. Facebook and Google primarily get value from your personal information by hoarding it and treating both it and the data they derive from it as proprietary.

gorgoiler 7y ago
The last time I used Google Takeout to download my data I got all my emails, custom maps, YouTube uploads etc., as one might expect, but what I couldn’t find were: * all the URLs I’ve visited with my Google cookie loaded * all the searches I’ve ever done * all the ads I’ve clicked on. I know ad tech mechanics can be counter intuitive but I’m surprised they don’t have that information for me to download, especially when ads and search are the primary Google functions. Maybe these logs are pseudonymized in such a way that google can’t tie them to my identity?
- judge2020 7y ago
  They're technically not linked to your Google account I believe, https://policies.google.com/technologies/anonymization?hl=en https://policies.google.com/technologies/anonymization?hl=en (although we've seen how anonymized data can still be de-anonymized https://news.ycombinator.com/item?id=20513521 https://news.ycombinator.com/item?id=20513521 )
  - lotu 7y ago
    Correct google keeps two separate cookies one for ads and one for everything else. This was part of the agreement with the FTC when they bought Double Click. They are prohibited from joining those two cookies by that agreement.
  - gorgoiler 7y ago
    Thanks, that’s useful and interesting. Good on Google for keeping the two activities (and cookies) separate. [Edit: oof, I found my search history after all so most of this is moot. It’s under “Other Google Activity” ... “Web & App Activity”. I guess it would be nice to see the words “Search Activity” a little more prominently, but still, my bad.] I can’t help but feeling that both cookies (and their associated histories) count equally as personal data. Anyone who gets hold of my devices can use the cookies to get my history. I can use the cookies to get some of my history in some form or other (I can’t get my own search history, but I can see it partially in typeaheads on the desktop site.) It feels half hearted that I can’t pull up the entire dataset, but then I would surely be grateful that no one else can do the same thing if they steal my login. (I also accept that some of this is just me arrogantly pushing back on being told “no!” by Auntie Google, when I feel entitled to a yes.)

kitotik 7y ago

This is a critical point, but the definition of “sell” is fairly broad: “ “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.”

saagarjha 7y ago
So targeting ads based on personal information that you've collected is still OK, as long as you don't share the data?
- kitotik 7y ago
  It appears so. There is a possible argument that selling an ad that will use PII to target consumers to a 3rd party advertiser constitutes a “sale” however.
- chongli 7y ago
  The cynical side in me is now saying “of course! California’s government is not gonna shit where they eat.” We should not ever expect the government of the place where Google and Facebook are headquartered to do anything meaningful to protect privacy. To do so would destroy the business model of these companies. Why would they ever want to do that?

jiveturkey 7y ago

and what does GDPR say?

pmiller2 7y ago
IIRC, it refers primarily to collecting and processing consumer information.

uxamanda 7y ago

CCPA states that data is valuable and specifically calls out trading for "other valuable consideration" as part of selling. Therefore (in my read) if your business is "giving away" data, it would inherently be for "other valuable consideration". Especially since the law calls out 4 cases where sharing data is NOT a sale or valuable consideration: 1) When a consumer is sharing data with your business so that you can help them interact with a 3rd party business 2) Your business is sharing data to tell 3rd parties a consumer now wants to opt-out 3) Your business transfers data to a 3rd party to get a service from a service provider (and the data stops there, it can't be sold on) 4) Your business is acquired Edit: typo, confusing sentence

Gaelan 7y ago
IIRC google et al never share your data with third parties. Instead, they use it to target ads from third parties.

thanhhaimai 7y ago

This point is incorrect. There are unfortunately many companies that sell consumers' information directly [1][2]. I understand people have hatred for big companies collecting advertising related information. Nevertheless, it's misguided to pretend the industry of directly collecting and selling private information doesn't exist. Your ISPs can and do collect much worse data about us. The potential damage is much worse. I'm more worry about the lack of oversight on that industry. [1] https://arstechnica.com/tech-policy/2019/01/t-mobile-sprint-and-att-still-selling-your-location-data-report-says/ https://arstechnica.com/tech-policy/2019/01/t-mobile-sprint-... [2] https://www.forbes.com/sites/metabrown/2015/09/30/when-and-where-to-buy-consumer-data-and-12-companies-who-sell-it/ https://www.forbes.com/sites/metabrown/2015/09/30/when-and-w...